-: WPA3.
In this lesson, we're going to talk about WPA3.
Now, previously we've talked about WEP, WPA, and WPA2,
but now, we're going to bring in the latest version, WPA3.
Now, when we talk about WPA3,
this is just known as Wi-Fi Protected Access 3,
WPA3 is the shorten name for that.
This was introduced back in 2018, and it was designed
to strengthen the flaws that we found inside WPA2.
Now, when we talk about WPA3, this is the latest and greatest
incarnation of wireless security.
If your access point supports it, you should be using WPA3,
if it doesn't, then you're going to be stuck with WPA2.
Now, WPA3 has an equivalent cryptographic strength
of 192-bits when you're using it in Enterprise Mode,
now, that means it is much stronger than we had in WPA2.
Now, as we move into WPA3,
we have two different modes,
we have the Enterprise Mode mentioned here
and we have Personal Mode.
When we talk about WPA3-Enterprise Mode,
we're talking about the business use case
and this gives you additional security.
It's going to use an AES algorithm with 256-bits of encryption
and it's going to use a SHA-384 hash for integrity checking.
Now, I know we haven't talked about cryptography yet,
we're going to get there later
but as you're going to see in the cryptography lesson,
the larger these numbers are,
that means the larger the bit size of the key,
and that means it can be a stronger algorithm.
Now, when you look at the Personal Mode,
it's a little less strong.
When you look at WPA3-Personal Mode, it uses CCMP-128
and that means it's using a 128-bit key
inside of an AES algorithm inside CCMP.
Now, this is the minimum encryption required
for secure connectivity within Personal Mode.
There are some options to go higher than that
but again, it's going to depend on your particular access point.
Now, when we start talking about WPA3,
what was really the big change here,
besides increasing the cryptography a little bit
by increasing those key sizes,
there was one really big improvement
and it's the removal of the Pre-Shared Key exchange.
Now, if you remember when we talked about
WEP and WPA and WPA2, we talked about the fact
that they all had this Pre-Shared Key
and when we exchange that key over the network,
we could have a man-in-the-middle attack
or somebody snooping
and grab that key out and then crack it.
Now, with WPA3, that's not possible
because we've removed that key exchange,
instead, we use what's known
as a Simultaneous Authentication of Equals or SAE.
This is a secure password-based authentication
and password-authenticated key agreement method.
Now, by doing this, what we end up doing
is using this thing known as forward secrecy.
Now, what is forward secrecy?
Well, forward secrecy, also known as perfect forward secrecy,
is a feature of a key agreement protocol, just like SAE has,
that provides assurance that the session keys
will not be compromised even if the long-term secrets
used in the session key exchange have been compromised.
Now, this is a really big deal because even if somebody gets
the long-term password that you have for your network,
they still can't go in and authenticate as you,
this protocol, this forward secrecy, is going to prevent that.
Now, the way forward secrecy works
is it goes through a five-step process.
The first step only happens once.
This is when your access point and your client
use a public key system
to generate a pair of long-term keys.
That is that long-term key I just mentioned
that if this is compromised,
the rest of the system isn't compromised
and that's the big difference here with WPA3.
Now, the second step is that the access point and the client
are going to exchange a one-time-use session key.
They're going to use some kind of a secure algorithm to do it,
that might be something like Diffie-Hellman, for instance.
Now, what am I talking about
with this one-time use session key?
Well, let's say you and I wanted to connect to each other,
we want to make sure we talk to each other securely.
Well, we want to send some encryption over that tunnel,
to do that, we need to have a shared secret
that we can encrypt that tunnel with.
Well, here in step two,
the access point is going to create this one-time session key
by creating a random number.
It's going to send it as part of the key exchange,
using that long-term key from step one over to the client
and do an authentication.
Now, you know what the key is and I know what the key is
and we can both use that to secure the tunnel.
Then, we go on to step three
and this is where the access point
starts sending client messages and encrypts them
individually using that session key created.
So, we created this key in step two,
we've done the key exchange using Diffie-Hellman,
so you know what it is and I know it is,
and now, every time I send a message,
I'm going to encrypt it using that key,
which means when you get that message,
you can decrypt it on your side
because you know what that key is.
The fourth step
is that the client is going to decrypt that message,
they're going to do that with that one-time use session key
that we just talked about.
And then we move into our fifth step,
which is where we repeat this process over and over again
for every single message that's being sent.
This way, we can do this using that one-time use session key
over and over and over again.
Now, how do we maintain forward secrecy, though?
Well, notice I said, we're going to go back to step two,
step two is where we create a new one-time use session key.
So, we create a session key, we encrypt the message,
I sent it to you, you decrypt the message
and then we start over
and we get another one-time use session key.
So, even if you get the session key that I'm using right now,
in a minute, it's not going to be valid anymore
because we're constantly using new keys,
that's the benefit of WPA3 over its predecessors
and that's how it maintains perfect forward secrecy.
Now, I know this may seem a little confusing
because we're talking about some encryption techniques
that you may not have heard of yet,
don't worry, we're going to cover encryption in depth
as we go through this course,
but because we already talked about wireless networks,
it made sense to talk about WPA3 here.
Now, this concept that I just covered
with the key exchange protocol and the way this works,
this is actually a review from your Network+ studies.
So, if you've jumped into Security+ before doing Network+,
this may seem a little foreign to you.
If you need to look up the information on this,
go ahead and Google Diffie-Hellman key exchange
and you'll get an idea of how this works
or type in TLS key exchange
and you can go more in depth that way as well.